diff --git a/app/routes/transactions.py b/app/routes/transactions.py index 43b2cf6..63b747e 100644 --- a/app/routes/transactions.py +++ b/app/routes/transactions.py @@ -188,6 +188,11 @@ def edit(id): form.account_id.data = str(txn.account_id) form.category_id.data = str(txn.category_id) if txn.category_id else '' + next_url = request.form.get('next') or request.args.get('next', '') + # Only allow relative URLs to prevent open-redirect + if not next_url.startswith('/'): + next_url = '' + if form.validate_on_submit(): old_account_id = txn.account_id txn.transaction_type = active_type @@ -204,12 +209,13 @@ def edit(id): if txn.transaction_type == 'expense': from app.services.alert_service import check_and_flash_budget_alerts check_and_flash_budget_alerts(flash) - return redirect(url_for('transactions.index', tab=txn.transaction_type)) + return redirect(next_url or url_for('transactions.index', tab=txn.transaction_type)) return render_template('transactions/form.html', form=form, txn=txn, txn_type=active_type, + next_url=next_url, income_cats=_category_choices_json('income'), expense_cats=_category_choices_json('expense'), title='Edit Transaction') diff --git a/app/templates/transactions/form.html b/app/templates/transactions/form.html index ad75002..6dd1589 100644 --- a/app/templates/transactions/form.html +++ b/app/templates/transactions/form.html @@ -61,6 +61,7 @@
{{ form.hidden_tag() }} {{ form.transaction_type() }} +
diff --git a/app/templates/transactions/index.html b/app/templates/transactions/index.html index af1ffbe..2fb536d 100644 --- a/app/templates/transactions/index.html +++ b/app/templates/transactions/index.html @@ -94,7 +94,7 @@ {% if txn.transaction_type=='income' %}+{% else %}-{% endif %}{{ txn.amount | currency }} - Edit + Edit